Application Security - Implementing Database Security and Auditing - page 155

Figure 5.6
Getting a list of all
user objects using a
UNION attack.
base errors of the form “all queries in SQL statements containing a
UNION operator must have an equal number of expressions in their target
lists,” then you have a strong indicator that a SQL injection attack may be
in progress.
Finally, let's quickly look at another common SQL injection pattern—
one involving insert selects. This method uses the fact that all major data-
base vendors support the use of subqueries and the fact that SELECT sub-
queries can be used within an INSERT request. As an example, suppose
that you have a screen that allows you to add a message to a message board,
as shown in Figure 5.7.
Figure 5.7
Adding a message
to a message board.